tin-spa 20.14.113 → 20.16.0

package/fesm2022/tin-spa-core.mjs

@@ -1,6 +1,6 @@
 import { AUTH_TOKEN_KEY, AUTH_REFRESH_TOKEN_KEY } from 'tin-spa/keys';
 import * as i0 from '@angular/core';
-import { Injectable, NgModule, inject, Component, InjectionToken, makeEnvironmentProviders, Optional, Inject, Injector, EventEmitter, Output, Input, ENVIRONMENT_INITIALIZER } from '@angular/core';
+import { Injectable, NgModule, inject, Component, InjectionToken, makeEnvironmentProviders, Optional, Inject, Injector, EventEmitter, Output, Input, ViewChild, ENVIRONMENT_INITIALIZER } from '@angular/core';
 import * as i1$2 from '@angular/material/dialog';
 import { MatDialogModule, MAT_DIALOG_DEFAULT_OPTIONS, MatDialogRef, MAT_DIALOG_DATA, MatDialog } from '@angular/material/dialog';
 import * as i1 from '@angular/common/http';
@@ -48,10 +48,8 @@ import { MatTooltipModule } from '@angular/material/tooltip';
 import { MatSidenavModule } from '@angular/material/sidenav';
 import { MatToolbarModule } from '@angular/material/toolbar';
 import { MatExpansionModule } from '@angular/material/expansion';
-import { MSAL_INSTANCE, MsalService } from '@azure/msal-angular';
-import { PublicClientApplication, BrowserCacheLocation } from '@azure/msal-browser';
+import { setTinFallbackTokenAttacher, createTinTokenAttacher } from 'tin-spa/http';
 import * as i2$2 from '@abacritt/angularx-social-login';
-import { setTinFallbackTokenAttacher } from 'tin-spa/http';
 
 // Added (NFD-1): resolves a Field.min / Field.max bound that is expressed as a DYNAMIC TOKEN rather than a
 // literal date, so a config can say `max: 'today'` and mean "today at the moment the control is rendered",
@@ -237,6 +235,13 @@ class Core {
         if (!security) {
             return true;
         }
+        // Added (A-0902-71): fail CLOSED on an absent role. Both branches below dereference `currentRole`, so a
+        // null/undefined role THREW out of an authorization check instead of denying — the worst failure mode there
+        // is. The `!security` early return above stays first and is untouched: a surface that declares no security
+        // config is not gated at all and must keep rendering while the role is still in flight.
+        if (!currentRole) {
+            return false;
+        }
         if (security.deny?.some(role => currentRole[role.name])) {
             return false;
         }
@@ -324,6 +329,96 @@ class Core {
             return false;
         return this.resolveVisibility(item.visible, data) !== false;
     }
+    // ---------------------------------------------------------------------------
+    // Added (spa-charts-empty-state): the ONE emptiness rule for charts, kept here rather than in
+    // charts.component so spa-dashboard can ask the same question without reaching into a child component.
+    //
+    // A chart is EMPTY when nothing would draw: no datasets, or no dataset carries a finite non-zero value.
+    // All-zero counts as empty deliberately — a bar grid of six zero months and a line at -1..1 are the same
+    // blank slab to a reader as a chart with no series at all, and both are what the Piglet Health dashboard
+    // showed on a farm with no deaths.
+    // ---------------------------------------------------------------------------
+    static isChartDataEmpty(chartData) {
+        const sets = chartData?.datasets;
+        if (!Array.isArray(sets) || sets.length === 0)
+            return true;
+        return !sets.some((ds) => Array.isArray(ds?.data) && ds.data.some((v) => this.chartPointValue(v) !== 0));
+    }
+    // Chart.js accepts a bare number or a {x,y}/{y} point; anything else (null, undefined, NaN) is "no value"
+    static chartPointValue(v) {
+        const n = typeof v === 'number' ? v : (v && typeof v === 'object' ? Number(v.y) : NaN);
+        return Number.isFinite(n) ? n : 0;
+    }
+    // A GAUGE is never empty — gaugeValue 0 is a real, deliberate "0%" reading, not missing data
+    static isChartEmpty(chart, data) {
+        if (!chart)
+            return true;
+        if (chart.gaugeValue != null)
+            return false;
+        return this.isChartDataEmpty(data?.[chart.name] ?? chart.data); // same resolution order charts.component.buildChartData uses
+    }
+    // Does this chart put a CARD on the page at all? Visibility first, then the opt-in empty-hide.
+    // hideWhenEmpty is read chart-first, then grid; absent on both it is FALSE, so the default is the
+    // in-card empty state and no untracked consumer loses a card it renders today.
+    static isChartRendered(chart, config, data) {
+        if (!this.isItemVisible(chart, data))
+            return false;
+        const hide = chart?.hideWhenEmpty ?? config?.hideWhenEmpty ?? false;
+        return !(hide && this.isChartEmpty(chart, data));
+    }
+    // ---------------------------------------------------------------------------
+    // Added (spa-charts-empty-state, tiles twin): the SAME emptiness rule applied to a chart TILE.
+    //
+    // A chart tile is the small sibling of a chart card, and before this it had the identical defect:
+    // tiles.component.html guarded only the CANVAS, so a tile with no series drew its label and then a
+    // labelled empty box. There is deliberately NO second rule here — the resolution differs (a tile names
+    // its series with `dataField` and may carry a PLAIN ARRAY, which the tile builder wraps into one
+    // dataset) but the verdict is always isChartDataEmpty's.
+    //
+    // Two exemptions, both matching the chart's: a GAUGE is never empty (a 0% reading is a reading, whether
+    // it comes from a static gaugeValue or from a numeric dataField feeding one), and a NON-chart tile is
+    // never empty at all — no ordinary figure tile can be removed by this rule.
+    // ---------------------------------------------------------------------------
+    static isTileChartEmpty(tile, data) {
+        const chart = tile?.chart;
+        if (!chart)
+            return false; // not a chart tile — this rule has nothing to say about it
+        if (chart.gaugeValue != null)
+            return false;
+        const series = (chart.dataField ? data?.[chart.dataField] : null) ?? chart.data; // same order buildTileMiniChartData resolves in
+        if (typeof series === 'number')
+            return false; // a doughnut gauge fed by dataField: 0 is a real reading
+        return this.isChartDataEmpty(Array.isArray(series) ? { datasets: [{ data: series }] } : series); // a plain array is wrapped exactly as the tile builder wraps it
+    }
+    // Does this tile put a CARD in the row at all? Visibility first, then the opt-in empty-hide — the same
+    // shape, the same precedence and the same flag NAMES as isChartRendered, so a consumer configuring a
+    // tile and a chart side by side writes the same thing twice.
+    static isTileRendered(tile, config, data) {
+        if (!this.isItemVisible(tile, data))
+            return false;
+        const hide = tile?.hideWhenEmpty ?? config?.hideWhenEmpty ?? false;
+        return !(hide && this.isTileChartEmpty(tile, data));
+    }
+    // ---------------------------------------------------------------------------
+    // Added (spa-charts-empty-state, dangling heading): the capability gate for a LIST of config items,
+    // lifted verbatim out of tiles.component.applySecurity and charts.component.applySecurity so that
+    // spa-dashboard can ask "would this widget draw anything?" without a second copy of the rule drifting
+    // from the two it must agree with. Both components now call this; their behaviour is unchanged.
+    //
+    // STRICTLY OPT-IN, and the opt-in test stays explicit: unless the container declares `security` or some
+    // item declares `securityConfig`, the list is returned VERBATIM (same array reference) and denied is
+    // false — so an unresolved role can never blank a page that declared nothing, which is the guarantee
+    // owed to the untracked external consumers of this library.
+    // ---------------------------------------------------------------------------
+    static gatedItems(items, security, role) {
+        const declares = !!security || (items ?? []).some(i => !!i.securityConfig);
+        if (!declares)
+            return { items: items, denied: false };
+        if (!this.checkSecurity(security, role))
+            return { items: [], denied: true }; // the whole container refused
+        const kept = (items ?? []).filter(i => this.checkSecurity(i.securityConfig, role));
+        return { items: kept, denied: kept.length === 0 };
+    }
     static testVisible(config, data, field, currentRole) {
         // First check form level security if exists
         if (config.security && !this.hasFormAccess(config, currentRole)) {
@@ -442,6 +537,32 @@ class Core {
         });
         return payload;
     }
+    // Added (CFW-1 6b): the DISPLAY half of serverOwned, and the counterpart to buildSubmitPayload above.
+    // buildSubmitPayload omits a server-owned key from the WIRE but deliberately leaves the bound model intact, so
+    // that model keeps the value it was loaded with. Hand it back to the grid after a save and the operator is
+    // shown the stale figure the server has just recomputed and discarded. Measured as the phase-6c kill-sheet
+    // symptom: a saved carcass line still read `0.00` for lineAmount — and 0.00 is exactly how a CONDEMNED carcass
+    // reads, so the one wrong value on offer was the one that means "this pig paid nothing".
+    //
+    // A COPY with the key OMITTED, never null and never zero, for the same reason buildSubmitPayload omits: an
+    // absent key leaves the grid's existing cell alone, while a null would paint an empty cell over a correct one.
+    // Call this ONLY when there is no server body to adopt — when the response carried one, the model IS the
+    // server's truth and stripping would throw away the very value that makes the screen right.
+    static stripServerOwned(config, data) {
+        if (!data || !config?.fields)
+            return data;
+        const stripped = { ...data }; // shallow, matching buildSubmitPayload — the model is plain JSON
+        const omit = (field) => {
+            if (!field?.name || !field.serverOwned)
+                return;
+            delete stripped[field.name];
+        };
+        config.fields.forEach(field => {
+            omit(field);
+            field.subfields?.forEach(subfield => omit(subfield)); // a composite's subfields carry their own keys
+        });
+        return stripped;
+    }
     static testReadOnly(config, data, field) {
         // Added (CFW-1): serverOwned outranks EVERY mode, create included. `readonly` cannot express this — the
         // create branch below returns false for every field, so a readonly server-owned figure was fully editable
@@ -511,6 +632,12 @@ class Core {
         ;
         return '';
     }
+    // Added (PRF-1): a resolved date bound, written the way the user would have to pick it. Same format and same
+    // vocabulary as date.component.describeBound, so the submit gate and the field's own error cannot describe the
+    // same rule two different ways.
+    static describeDateBound(d) {
+        return d.toLocaleDateString('en-GB', { day: 'numeric', month: 'short', year: 'numeric' });
+    }
     // Changed: the per-field checks, lifted out of validateObject unchanged so the loop can report the failing field
     static validateField(field, data) {
         if (field.type == 'file' || field.type == 'file-view' || field.type == 'blank' || field.type == 'section')
@@ -546,10 +673,24 @@ class Core {
                 // to them would change nothing but is not this chunk's to prove.
                 if ((field.type == 'date') && d === '')
                     return `Please select ${name}`;
-                if (field.min && d < field.min)
-                    return `Minimum  ${name} is ${field.min}`;
-                if (field.max && d > field.max)
-                    return `Maximum ${name} is ${field.max}`;
+                // Changed (PRF-1): a DATE bound is resolved through DateBounds before it is compared, exactly as the
+                // date control itself resolves it (date.component.refreshBounds). Field.min/max on a date may be a
+                // token ('today', 'today-28') or a FUNCTION evaluated against the live row — a documented part of the
+                // Field API since SBD-1 — and this gate compared the raw value against the raw bound. A function bound
+                // was therefore coerced to its own SOURCE TEXT, and '2026-09-03' > '(x) => {' is true, so EVERY submit
+                // was refused with the function body printed back at the operator while the picker itself showed no
+                // error. Measured on piglet's Record Farrowing dialog, whose farrowingDate carries function bounds:
+                // 0 mat-error, button enabled, no POST, toast reading "Maximum Farrowing Date is (x) => {...".
+                // A resolved bound of null means "no bound", so a literal date, an absent bound and an unparseable one
+                // all behave as before. number and money keep the literal comparison — correct for them, and untouched.
+                // Changed (TDB-1): the date branch moved OUT of `if (isRequired)` — see the checkDateBounds call below.
+                // number and money keep the literal comparison here, unchanged and still required-only.
+                if (field.type != 'date') {
+                    if (field.min && d < field.min)
+                        return `Minimum  ${name} is ${field.min}`;
+                    if (field.max && d > field.max)
+                        return `Maximum ${name} is ${field.max}`;
+                }
             }
             else if (field.type == 'datetime') {
                 if (d === '')
@@ -580,6 +721,21 @@ class Core {
                     return `Please enter ${name}`;
             }
         }
+        // Added (TDB-1): a date's min/max is now enforced whenever the field HOLDS A VALUE, required or not. PRF-1
+        // fixed how a bound is resolved but left the check inside `if (isRequired)`, so an OPTIONAL date could carry
+        // any value at all and the submit gate never looked — while the picker beside it greyed the same days out.
+        // Two live examples: piglet's dateOfBirth (piggery.service.ts:1047 and :1511), both non-required and both
+        // carrying function bounds. An empty optional date still passes: DateBounds.resolve returns null for
+        // null/undefined/'' so `value` is falsy and both comparisons are skipped, which is what "optional" means.
+        if (field.type == 'date') {
+            const value = DateBounds.resolve(d, 'start');
+            const floor = DateBounds.resolve(field.min, 'start', data);
+            const ceiling = DateBounds.resolve(field.max, 'end', data);
+            if (value && floor && value < floor)
+                return `Earliest ${name} is ${this.describeDateBound(floor)}`;
+            if (value && ceiling && value > ceiling)
+                return `Latest ${name} is ${this.describeDateBound(ceiling)}`;
+        }
         if (field.type == 'text' && field.regex && d && d.toString().trim() !== '') {
             const regexPattern = new RegExp(field.regex.pattern);
             if (!regexPattern.test(d)) {
@@ -1536,6 +1692,8 @@ class TileConfig {
 // Changed: Added chart config container class
 class ChartConfig {
 }
+class DashboardConfig {
+}
 class Step {
 }
 class StepConfig {
@@ -1827,7 +1985,10 @@ class MessageService {
     }
     // Added: warning — for something the user should look at but which is not a failure. Distinct from error so
     // a recoverable situation is not dressed up in the same red as a broken one.
-    warning(details, subject) {
+    // Changed: argument order is now (subject, details), matching errorWithSubject/infoWithSubject instead of
+    // contradicting them. Safe to reorder rather than deprecate because the only caller in the estate is the
+    // message gallery — swept across ng-space and all five consumer apps (src + e2e) before the change.
+    warning(subject, details) {
         let type = "warning";
         const dialogRef = this.dialog.open(messageDialog, {
             width: "600px",
@@ -1835,7 +1996,9 @@ class MessageService {
         });
     }
     // Added: success — completes the set, so a confirmation does not have to borrow the 'info' styling.
-    success(details, subject) {
+    // Changed: argument order is now (subject, details), matching errorWithSubject/infoWithSubject. Same
+    // zero-external-caller evidence as warning above.
+    success(subject, details) {
         let type = "success";
         const dialogRef = this.dialog.open(messageDialog, {
             width: "600px",
@@ -2252,7 +2415,8 @@ async function loadTinSpaAppSettings() {
 // tin-spa runtime configuration
 //
 // Centralises the "which runtime behaviours does this app want" decisions that used to be
-// scattered across each consuming app (routing strategy, real-time/SignalR, Microsoft SSO).
+// scattered across each consuming app (routing strategy, real-time/SignalR).
+// Changed (20.14.114): Microsoft SSO is NO LONGER wired here - see the L3b note at the imports.
 //
 // A consuming app declares intent in ONE place:
 //
@@ -2350,56 +2514,15 @@ function tinSpaRuntimeConfigFactory(codeConfig) {
     }
     return merged;
 }
-function tinSpaMsalInstanceFactory(config) {
-    const wantsMsal = !!config.microsoftAuth;
-    const secure = typeof window === 'undefined' || window.isSecureContext;
-    // A credential is "provided" only if non-empty — appsettings.json ships empty strings as
-    // placeholders, and those must trigger the same diagnostics as a missing section.
-    const missing = [];
-    if (!config.msal?.clientId?.trim())
-        missing.push('ClientId');
-    if (!config.msal?.authority?.trim())
-        missing.push('Authority');
-    if (wantsMsal && missing.length) {
-        console.error(`[tin-spa] Microsoft SSO is enabled but its credentials are incomplete — missing: ${missing.join(', ')}. ` +
-            `Provide them in assets/appsettings.json under "Msal" (or in provideTinSpaRuntime({ msal })). Microsoft SSO is INACTIVE.`);
-    }
-    if (wantsMsal && !secure) {
-        console.warn('[tin-spa] microsoftAuth is enabled but the app is NOT running over HTTPS (secure context). Microsoft SSO is INACTIVE until served over HTTPS.');
-    }
-    const active = wantsMsal && !missing.length && secure;
-    if (!active) {
-        // Stub: MsalService's constructor calls instance.initializeWrapperLibrary(), so it must exist
-        // or the app crashes at bootstrap. loginPopup rejects so callers' error handlers report it.
-        return {
-            initializeWrapperLibrary: () => { },
-            initialize: () => Promise.resolve(),
-            getAllAccounts: () => [],
-            getActiveAccount: () => null,
-            loginPopup: () => Promise.reject(new Error(!wantsMsal ? 'Microsoft login is disabled in app config.'
-                : missing.length ? `Microsoft login is not configured (missing: ${missing.join(', ')}).`
-                    : 'Microsoft login requires HTTPS (a secure context).')),
-        };
-    }
-    // RedirectUri rule: use the configured value when provided; otherwise fall back to
-    // `${origin}/login` — correct whenever each environment's own /login URL is registered
-    // on the app registration.
-    const redirectUri = config.msal.redirectUri?.trim() || `${window.location.origin}/login`;
-    console.info(`[tin-spa] Microsoft SSO active — redirectUri: ${redirectUri}` +
-        (config.msal.redirectUri?.trim() ? ' (configured)' : ' (not configured — derived from window.location.origin)'));
-    const pca = new PublicClientApplication({
-        auth: { ...config.msal, redirectUri },
-        cache: { cacheLocation: BrowserCacheLocation.LocalStorage, storeAuthStateInCookie: false },
-    });
-    // MSAL v3 requires initialize() before any other API call. Kick it off now so it has
-    // normally completed by the time the user clicks a login button; callers still await
-    // initialize() themselves (it is idempotent) to close the race.
-    pca.initialize().catch(e => console.error('[tin-spa] MSAL initialize failed:', e));
-    return pca;
-}
+// Changed (20.14.114, L3b): `tinSpaMsalInstanceFactory` was REMOVED with the vendor imports. It existed
+// only to build the MSAL_INSTANCE that provideTinSpaRuntime() used to provide, and it could not be kept
+// without importing PublicClientApplication. The `microsoftAuth` / `msal` config fields are RETAINED -
+// they are still merged from assets/appsettings.json and remain the per-environment switch an app reads
+// when it registers MSAL itself.
 // ── Public API ───────────────────────────────────────────────────────────────
 /**
- * Wires up tin-spa runtime behaviours (routing strategy, real-time, MSAL) from a single config.
+ * Wires up tin-spa runtime behaviours (routing strategy, real-time) from a single config.
+ * Changed (20.14.114): no longer provides MSAL - an app that wants Microsoft SSO registers it itself.
  * Add the result to your AppModule (or bootstrap) providers.
  */
 function provideTinSpaRuntime(config) {
@@ -2413,10 +2536,9 @@ function provideTinSpaRuntime(config) {
             useFactory: tinSpaLocationStrategyFactory,
             deps: [PlatformLocation, [new Optional(), new Inject(APP_BASE_HREF)], TIN_SPA_RUNTIME_CONFIG],
         },
-        // MSAL_INSTANCE is built lazily (when MsalService is first injected, i.e. on the login page),
-        // so it reads the config token rather than running at bootstrap.
-        { provide: MSAL_INSTANCE, useFactory: tinSpaMsalInstanceFactory, deps: [TIN_SPA_RUNTIME_CONFIG] },
-        MsalService,
+        // Changed (20.14.114, L3b): the MSAL_INSTANCE and MsalService providers were REMOVED. Providing them
+        // from core forced every consumer to carry the vendor bundle whether or not it uses Microsoft SSO.
+        // An app that wants it now provides MsalModule.forRoot(...) itself, alongside provideTinSpaRuntime().
     ]);
 }
 
@@ -3089,6 +3211,10 @@ class SignalRService {
         this.entityCreated$ = this.entityCreated.asObservable();
         this.entityUpdated$ = this.entityUpdated.asObservable();
         this.entityDeleted$ = this.entityDeleted.asObservable();
+        // Added (A-0902-40): the invalidation stream. A plain Subject, like the position stream above — a listener
+        // that has not opted in pays nothing, and nothing in the library subscribes to it by default.
+        this.entityInvalidated = new Subject();
+        this.entityInvalidated$ = this.entityInvalidated.asObservable();
         // Added (GPS phase 4): the position stream. A plain Subject, so a page that is not showing a map pays
         // nothing for it, and a page that is subscribes for exactly as long as it is open.
         this.vehiclePosition = new Subject();
@@ -3197,6 +3323,12 @@ class SignalRService {
         this.hubConnection.on('EntityDeleted', (entityName, data) => {
             this.entityDeleted.next({ entityName, data });
         });
+        // Added (A-0902-40): the payload-free channel — deliberately a SEPARATE hub method from the Entity* trio.
+        // Routing it through EntityUpdated with an empty payload would reach the table's row-replace handler and
+        // blank a row; the server sends a name and, at most, an id, and the listener re-reads instead.
+        this.hubConnection.on('EntityInvalidated', (entityName, id) => {
+            this.entityInvalidated.next({ entityName, id });
+        });
         // Added (GPS phase 4): live vehicle position frames. Deliberately a SEPARATE hub method from the
         // Entity* trio and not routed through them — a position carries six scalars and must never trigger
         // the table-reload machinery those events drive. The frame is emitted verbatim; mapping it to the
@@ -3317,6 +3449,10 @@ class OfflineService {
         //---------------- Registry ----------------
         this.entries = new Map();
         this.readUrls = new Map();
+        // Added: the LOOKUP urls specifically, so serveCachedRead can enforce `lookupMaxAgeHours` on option lists only.
+        // A grid's cached rows have no declared age limit and must keep being served however old they are; an option
+        // list does — and the limit was declared and defaulted but never read, so a dropdown was served indefinitely.
+        this.lookupUrls = new Map();
         this.readPrefixes = [];
         this.registered$ = new BehaviorSubject(false);
         //---------------- Runtime flags ----------------
@@ -3489,6 +3625,7 @@ class OfflineService {
             if (url && (allow === true || (Array.isArray(allow) && allow.includes(url)))) {
                 if (!this.readUrls.has(url))
                     this.readUrls.set(url, entry);
+                this.lookupUrls.set(url, entry); // Changed: remember this url is a LOOKUP so its age limit can be enforced
             }
             if (field.detailsConfig?.formConfig)
                 this.registerLookups(field.detailsConfig.formConfig, entry, depth + 1);
@@ -3795,6 +3932,16 @@ class OfflineService {
     async serveCachedRead(url) {
         const saved = await this.getRead(url);
         let data = saved?.data ?? null;
+        // Added: enforce `lookupMaxAgeHours` — declared on OfflineConfig and defaulted in register(), but never read
+        // anywhere, so an option list cached months ago was still served as current. Only LOOKUP urls are aged.
+        // Pending offline creates are still appended below, so an expired list degrades to the not-yet-synced
+        // parents rather than to nothing at all.
+        const lookup = this.lookupUrls.get(url);
+        if (lookup && saved) {
+            const maxAgeMs = (lookup.config.lookupMaxAgeHours ?? 72) * 3600000;
+            if (maxAgeMs > 0 && Date.now() - (saved.savedAt ?? 0) > maxAgeMs)
+                data = null;
+        }
         const listMatch = url.match(/^([^?/]+)\/list\//);
         if (listMatch) {
             const creates = await this.pendingCreates(listMatch[1]);
@@ -4501,6 +4648,29 @@ class AuthService {
         this.authTypeObserv = this.authTypeSource.asObservable();
         this.initializeGoogleAuth();
         this.initVisibilityRefresh(); // Changed: Refresh token when tab becomes visible after being hidden
+        // Added (cold-reload 401, option D): install the FALLBACK token attacher from here, so it is in place
+        // for every tier of every app rather than only for whoever remembered to register
+        // TIN_LOGIN_TIER_HTTP_PROVIDERS on one route.
+        //
+        // 🔴 THE DEFECT THIS FIXES: shift-spa registered the login tier's providers on the LOGIN route only
+        // (login.routes.ts:67, INDEX_ROUTES' `path: ''`). A COLD RELOAD straight into #/home/... never matches
+        // that path, so the slot stayed empty and TinRootInterceptor took its fail-open branch
+        // (root-interceptor.ts, the third branch) — measured: `configuration/get auth=0 -> 401`,
+        // `accounts/list/x auth=0 -> 401`. The obvious fix, registering those providers at the eager root, was
+        // MEASURED on 2026-09-03 and REFUSED: +1.18 MB raw / +185 kB transfer, because that file imports this
+        // service and this service's DI graph is most of the primary.
+        //
+        // WHY HERE IS BOTH EARLY ENOUGH AND FREE: this service is providedIn:'root', so there is exactly one
+        // instance, and on a cold reload the shell's canMatch guard injects it and calls tryRestoreSession()
+        // before the router will admit any authenticated page — so this runs ahead of the first authenticated
+        // request. And `createTinTokenAttacher` comes from tin-spa/http, which imports only @angular/core and
+        // @angular/common/http, so it adds nothing anywhere.
+        //
+        // SAFE IN EVERY OTHER APP TOO: the slot is write-once (setTinFallbackTokenAttacher returns early if it
+        // is already filled) and the DELEGATE ALWAYS WINS — TinRootInterceptor consults the primary's delegate
+        // first and never reaches the attacher once the primary has loaded. `getToken` is read per request, so
+        // installing before a token exists is correct: an empty token returns the request unchanged.
+        setTinFallbackTokenAttacher(createTinTokenAttacher(() => this.tokenSource.value));
     }
     initializeGoogleAuth() {
         if (this.googleAuthInitialized) {
@@ -4801,8 +4971,32 @@ class AuthService {
     // Shared entry point for any page that needs to auto-redirect authenticated users
     // Returns true if session is active or was successfully restored via silent refresh
     async tryRestoreSession() {
+        // Changed (relogin-role-state RRS-1): the valid-session path now HYDRATES the session instead of merely
+        // reporting that one exists on disk.
+        //
+        // hasValidSession() reads the STORED token expiry. It answers "there is a live session here" without
+        // restoring a single thing: not loggedin, not the token, not the user, and — the one that bites — not the
+        // ROLE. It returned true into a service still holding the empty `new Role()` it is constructed with, so a
+        // shell admitted on this path rendered every capability gate against a role with no capabilities. Those
+        // gates read the role ONCE at init and never again (table.component.ts:72-73 in ensureInitialized, which
+        // "runs exactly once per instance"; form.component.ts:37; app-configuration.component.ts:183;
+        // form-skeleton.component.ts:78; detailsDialog.component.ts:692), so the refusal was PERMANENT.
+        //
+        // MEASURED on shift-spa against a throwaway database: a hard reload onto #/home/vehicles as admin
+        // (Roles.Cap105 = 4, login payload role.cap105 = 4) was refused 5 times out of 5 with
+        // "You do not have access to Vehicle", and 7 seconds later currentRoleSource still read
+        // { roleName: 'New Role' } with loggedin FALSE — UpdateRole had never been called at all. The same page
+        // reached by in-app navigation rendered the grid every time.
+        //
+        // 🔑 Why it looked intermittent: the hasRefreshToken() line below ALREADY hydrates, because silentRefresh
+        // ends in applyLoginResponse. So an EXPIRED stored token restored perfectly while a still-VALID one
+        // refused — the healthier the session, the more broken the page.
+        //
+        // checkAuthentication() is the app's existing hydration routine (the one authGuard awaits) and is
+        // idempotent: with a live in-memory session it returns Promise.resolve(true) without touching storage,
+        // which is exactly the case every caller of tryRestoreSession() hits on a warm navigation.
         if (this.hasValidSession())
-            return true;
+            return this.checkAuthentication();
         if (this.hasRefreshToken())
             return (await this.silentRefresh()) === 'success'; // Changed: silentRefresh now returns a tri-state result
         return false;
@@ -4882,10 +5076,28 @@ class AuthService {
             this.storage.get(Constants.AUTH_NAME).then((resp) => {
                 this.updateLoggedUserFullName(resp);
             });
-            this.storage.get(Constants.AUTH_ROLES).then((resp) => {
-                let ret = JSON.parse(resp);
-                this.UpdateRole(ret);
-            });
+            // Changed (relogin-role-state RRS-1): AWAITED, not fire-and-forget — the returned promise below now waits
+            // for this one. authGuard awaits ONLY what checkAuthentication returns (auth.guard.ts:17), and that used to
+            // be chained off the TOKEN read alone, so the router admitted the route — and Angular built the page's
+            // components — while currentRoleSource still held the empty `new Role()`. Every capability gate in the
+            // library reads that value ONCE at init and never again (table.component.ts:72-73 inside ensureInitialized,
+            // which "runs exactly once per instance"; form.component.ts:37; form-skeleton.component.ts:78;
+            // detailsDialog.component.ts:692; table-config.service.ts:108), so the role landing a microtask later
+            // repainted nothing: the page kept a PERMANENT "You do not have access to <entity>" refusal.
+            // MEASURED on shift-spa against a throwaway database: a hard reload onto #/home/vehicles as admin
+            // (Roles.Cap105 = 4) was refused 5 times out of 5, while the same page reached by in-app navigation
+            // rendered the grid every time — i.e. pressing F5 on any secured grid locked the user out of it.
+            // Failure-safe: a missing or unparseable role leaves the current value alone and still resolves, so a
+            // corrupt storage entry can never reject the guard or blank a live session (it previously threw inside the
+            // callback, where the rejection was swallowed unhandled).
+            const roleRestored = this.storage.get(Constants.AUTH_ROLES).then((resp) => {
+                if (!resp)
+                    return;
+                try {
+                    this.UpdateRole(JSON.parse(resp));
+                }
+                catch { /* corrupt entry — keep the role we already hold */ }
+            }).catch(() => { });
             this.storage.get(Constants.AUTH_TENANT_NAME).then((resp) => {
                 this.updateTenantName(resp);
             });
@@ -4897,7 +5109,10 @@ class AuthService {
                     this.UpdateAuthType(resp);
             });
             // Changed: Load token and check validity — if expired, await silentRefresh before allowing navigation
-            return this.storage.get(Constants.AUTH_TOKEN).then((token) => {
+            // Changed (relogin-role-state RRS-1): the chain now STARTS from roleRestored, so the guard cannot resolve
+            // — and no component can be created — before the restored role is on currentRoleSource. The two reads run
+            // concurrently (both were issued above); this only orders the RESOLUTION, so it costs nothing on the wire.
+            return roleRestored.then(() => this.storage.get(Constants.AUTH_TOKEN)).then((token) => {
                 this.UpdateToken(token);
                 return this.storage.get(Constants.AUTH_TOKEN_EXPIRE);
             }).then((expire) => {
@@ -5166,9 +5381,10 @@ class InventoryService {
         this.productsTableConfig = {
             showFilter: true,
             flatButtons: true,
+            identityColumn: 'name', // Added (clickable-identity Phase 9): `name` IS the product. Declared, not left to the convention, so the locked-row cue and the TinSync icons can never drift onto sku/description
             minColumns: ['name', 'sku', 'categoryName'],
             columns: [
-                { name: 'name', type: 'text', alias: 'Product Name' },
+                { name: 'name', type: 'button', alias: 'Product Name' }, // Changed (clickable-identity Phase 9): text -> button. The product's name is the row's identity and now opens the product itself, like every app's identity column. detailsConfig is NOT set here — it is wired in the constructor, because productDetailsConfig does not exist yet when this field initializer runs
                 { name: 'sku', type: 'text', alias: 'SKU' },
                 { name: 'categoryName', type: 'text', alias: 'Category' },
                 { name: 'brandName', type: 'text', alias: 'Brand' },
@@ -5213,6 +5429,7 @@ class InventoryService {
         // Product components table for bundle details
         this.productComponentsTableConfig = {
             tabTitle: 'Components',
+            identityColumn: false, // Added (clickable-identity Phase 9b, A-0902-13/-18): a component LINE of a bundle, not a record of its own — the bundle is the thing identified
             showFilter: false,
             elevation: 'none',
             flatButtons: true,
@@ -5269,11 +5486,13 @@ class InventoryService {
         this.bundleProductCreateButton = { name: 'create', display: 'Create Bundle', dialog: true, action: { url: 'products?action=create', method: 'post' } };
         // Table configuration for bundle products
         this.bundleProductsTableConfig = {
+            identityColumn: 'name', // Added (clickable-identity Phase 9b): the bundle`s own name identifies the row
             showFilter: true,
             flatButtons: true,
             minColumns: ['name', 'sku', 'bundleAvailableQuantity'],
             columns: [
-                { name: 'name', type: 'text', alias: 'Bundle Name' },
+                { name: 'name', type: 'button', alias: 'Bundle Name', detailsConfig: this.bundleProductDetailsConfig },
+                // Changed (clickable-identity Phase 9b): text -> button, the row identity. detailsConfig is safe INLINE here - bundleProductDetailsConfig is an inline field initializer declared ABOVE this config, unlike productDetailsConfig which is constructor-assigned
                 { name: 'sku', type: 'text', alias: 'SKU' },
                 { name: 'bundleAvailableQuantity', type: 'number', alias: 'Available', icon: { name: 'info', color: '#2196F3', condition: (x) => x.bundleAvailableQuantity > 0 } }, // Changed: Removed infoMessage as it's not valid for columns
                 { name: 'bundleEstimatedCost', type: 'money', alias: 'Est. Cost' },
@@ -5317,11 +5536,13 @@ class InventoryService {
             buttons: [this.serviceItemCreateButton, this.serviceItemEditButton, this.serviceItemDeleteButton]
         };
         this.serviceItemsTableConfig = {
+            identityColumn: 'name', // Added (clickable-identity Phase 9b): the service`s own name identifies the row
             showFilter: true,
             flatButtons: true,
             minColumns: ['name', 'unitPrice', 'statusName'],
             columns: [
-                { name: 'name', type: 'text', alias: 'Service Name' },
+                { name: 'name', type: 'button', alias: 'Service Name', detailsConfig: this.serviceItemDetailsConfig },
+                // Changed (clickable-identity Phase 9b): text -> button, the row identity. detailsConfig is safe INLINE here - serviceItemDetailsConfig is an inline field initializer declared ABOVE this config, unlike productDetailsConfig which is constructor-assigned
                 { name: 'description', type: 'text', alias: 'Description' },
                 { name: 'unitPrice', type: 'money', alias: 'Unit Price' },
                 { name: 'taxRateName', type: 'text', alias: 'Tax Rate' }, // Changed: Tax rate display with N/A fallback
@@ -5355,6 +5576,7 @@ class InventoryService {
         };
         this.requisitionItemsTableConfig = {
             tabTitle: 'Items',
+            identityColumn: false, // Added (clickable-identity Phase 9b, A-0902-13/-18): a requisition LINE, not a record — the requisition is the thing identified
             showFilter: false,
             elevation: 'none',
             flatButtons: true,
@@ -5411,11 +5633,13 @@ class InventoryService {
         };
         this.requisitionViewButton = { name: 'view', dialog: true, detailsConfig: this.requisitionDetailsConfig };
         this.requisitionsTableConfig = {
+            identityColumn: 'requisitionNumber', // Added (clickable-identity Phase 9b): the requisition document number identifies the row
             showFilter: true,
             flatButtons: true,
             minColumns: ['requisitionNumber', 'requesterName', 'requestDate'],
             columns: [
-                { name: 'requisitionNumber', type: 'text', alias: 'Requisition #' },
+                { name: 'requisitionNumber', type: 'button', alias: 'Requisition #', detailsConfig: this.requisitionDetailsConfig },
+                // Changed (clickable-identity Phase 9b): text -> button, the row identity. detailsConfig is safe INLINE here - requisitionDetailsConfig is an inline field initializer declared ABOVE this config, unlike productDetailsConfig which is constructor-assigned
                 { name: 'requesterName', type: 'monogram', alias: 'Requested By' }, // Changed: monogram — the row still carries the full name, so filter/sort are untouched
                 { name: 'departmentName', type: 'text', alias: 'Department' },
                 { name: 'requestDate', type: 'date', alias: 'Request Date' },
@@ -5463,6 +5687,7 @@ class InventoryService {
             buttons: []
         };
         // Added (WS-1 sweep): paginated but deliberately NOT offline — InventoryItem does not implement ISync, so a queued write has no RowVersion/ClientRef to sync or dedupe on. Adding it is a migration, not a config change. A read-only cache for stock lookups on the floor belongs to the CACHE phase.
+        // FLAGGED, deliberately NOT given an identity (clickable-identity Phase 9b, Arbiter A-0902-24 Q3, MEDIUM): the only text candidate is `productName`, aliased 'Product', but the dialog opens the INVENTORY ITEM - the same label/target mismatch the grip maintenanceTableConfig fix removed. `serialNumber` is the item's true identity but renders 'N/A' for non-serialised stock (the objection that held piglet movementsTableConfig). The row `view` button remains the affordance. NOTE for any future retype: inventoryStockItemsTableConfig spreads this config and shares its columns array BY REFERENCE, so a retype here also lands in the Stock Items tab, which today has buttons: []
         this.inventoryItemsTableConfig = {
             showFilter: true,
             flatButtons: true,
@@ -5519,11 +5744,13 @@ class InventoryService {
         };
         // Updated: Added create/edit/delete buttons to table
         this.inventoryAdjustmentsTableConfig = {
+            identityColumn: 'adjustmentNumber', // Added (clickable-identity Phase 9b): the adjustment document number identifies the row; productName names the product it is ABOUT (Rule 2)
             showFilter: true,
             flatButtons: true,
             minColumns: ['adjustmentNumber', 'productName', 'reason'],
             columns: [
-                { name: 'adjustmentNumber', type: 'text', alias: 'Adjustment #' },
+                { name: 'adjustmentNumber', type: 'button', alias: 'Adjustment #', detailsConfig: this.inventoryAdjustmentDetailsConfig },
+                // Changed (clickable-identity Phase 9b): text -> button, the row identity. detailsConfig is safe INLINE here - inventoryAdjustmentDetailsConfig is an inline field initializer declared ABOVE this config, unlike productDetailsConfig which is constructor-assigned
                 { name: 'productName', type: 'text', alias: 'Product' },
                 { name: 'reason', type: 'text', alias: 'Reason' },
                 { name: 'adjustmentQuantity', type: 'number', alias: 'Quantity' },
@@ -5563,6 +5790,7 @@ class InventoryService {
         // Added: Return items table for details dialog
         this.inventoryReturnItemsTableConfig = {
             tabTitle: 'Items',
+            identityColumn: false, // Added (clickable-identity Phase 9b, A-0902-13/-18): a return LINE, not a record — the return is the thing identified
             showFilter: false,
             elevation: 'none',
             flatButtons: true,
@@ -5626,11 +5854,13 @@ class InventoryService {
         this.inventoryReturnCreateButton = { name: 'create', display: 'Create Return', dialog: true, action: { url: 'inventoryreturns?action=create', method: 'post' }, onSuccessButton: this.inventoryReturnViewButton };
         // Added: Main returns table config
         this.inventoryReturnsTableConfig = {
+            identityColumn: 'returnNumber', // Added (clickable-identity Phase 9b): the return document number identifies the row; entityName names the source it came FROM (Rule 2)
             showFilter: true,
             flatButtons: true,
             minColumns: ['returnNumber', 'entityName', 'returnDate'],
             columns: [
-                { name: 'returnNumber', type: 'text', alias: 'Return #' },
+                { name: 'returnNumber', type: 'button', alias: 'Return #', detailsConfig: this.inventoryReturnDetailsConfig },
+                // Changed (clickable-identity Phase 9b): text -> button, the row identity. detailsConfig is safe INLINE here - inventoryReturnDetailsConfig is an inline field initializer declared ABOVE this config, unlike productDetailsConfig which is constructor-assigned
                 { name: 'returnType', type: 'text', alias: 'Type' },
                 { name: 'entityName', type: 'text', alias: 'Source' },
                 { name: 'returnDate', type: 'date', alias: 'Date' },
@@ -5673,6 +5903,7 @@ class InventoryService {
             heroField: 'inventoryTransactionID',
             buttons: []
         };
+        // FLAGGED, deliberately NOT given an identity (clickable-identity Phase 9b, Arbiter A-0902-24 Q3, MEDIUM): columns[0] is a DATE, which is not an identity, and `productName` is aliased 'Product' while the dialog opens the TRANSACTION - the grip maintenanceTableConfig mismatch again. This is a read-only ledger (buttons: [] on its details config); the row `view` button remains the affordance
         this.inventoryTransactionsTableConfig = {
             showFilter: true,
             flatButtons: true,
@@ -5758,6 +5989,8 @@ class InventoryService {
         // Changed: dropdown quick-add — productDetailsConfig is built above (field initializers run before this constructor body), so wire the product selects here to avoid capturing undefined
         this.inventoryAdjustmentFormConfig.fields.find(f => f.name === 'productID').detailsConfig = this.productDetailsConfig;
         this.inventoryReturnItemFormConfig.fields.find(f => f.name === 'productID').detailsConfig = this.productDetailsConfig;
+        // Added (clickable-identity Phase 9): wire the product identity column's dialog here for the same reason as the two lines above — productsTableConfig is a field initializer and runs before this body, so referencing productDetailsConfig inline would capture undefined and open a blank drill-in
+        this.productsTableConfig.columns.find(c => c.name === 'name').detailsConfig = this.productDetailsConfig;
     }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: InventoryService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: InventoryService, providedIn: 'root' }); }
@@ -6707,7 +6940,12 @@ class AccountingService {
         this.accountTransactionsTableConfig = {
             ...this.transactionsTableConfig,
             causeFormRefresh: true,
-            minColumns: ['date', 'description', 'amountDisplay', 'runningBalance'], // Changed: Use amountDisplay instead of amount
+            // Changed: trimmed 4 -> 3 for CLAUDE.md's phone maximum. Kept the two that make a row identifiable (date,
+            // description) plus runningBalance, which is the only column unique to the ACCOUNT ledger and the question
+            // this view exists to answer. amountDisplay is dropped from the phone set, not from the table — it is still
+            // a full column on wider screens, and it is the one figure a reader can recover, as the step between two
+            // consecutive balances.
+            minColumns: ['date', 'description', 'runningBalance'],
             tabTitle: 'Account Transactions',
             loadAction: { url: 'transactions/account/x' }, loadCriteria: 'account', loadIDField: 'accountID',
             columns: [
@@ -7941,6 +8179,7 @@ class SalesService {
         };
         this.salesOrderItemsTableConfig = {
             tabTitle: 'Items',
+            identityColumn: false, // Added (clickable-identity Phase 9b, A-0902-13/-18): a sales-order LINE, not a record — the order is the thing identified
             // Added (delivered-order-lines-ui-gate): the three line buttons below are HIDDEN on a Delivered(2)/Cancelled(3) order, which on its own leaves the user staring at an uneditable list with nothing saying why or what to do instead. This is the same predicate as those buttons, reading config.parentData (the parent order), and the wording is the server's own from SalesOrderItemsController.CheckParentOrderOpen (lines 128 and 131) minus its "record of account" clause — same remedies, named in the same words, so the caption and a refusal toast can never contradict each other. The lines themselves stay listed and readable; only the writes are gone.
             caption: (o) => o?.status === 2 ? 'Cannot change lines on a delivered order — void the sale, raise a credit note against its invoice, then capture a new order.' : o?.status === 3 ? 'Cannot change lines on a cancelled order. Capture a new order instead.' : '',
             showFilter: false,
@@ -8006,11 +8245,13 @@ class SalesService {
         };
         this.salesOrderViewButton = { name: 'view', dialog: true, detailsConfig: this.salesOrderDetailsConfig };
         this.salesOrdersTableConfig = {
+            identityColumn: 'orderNumber', // Added (clickable-identity Phase 9b): the order number identifies the row; displayCustomerName names the customer it is FOR (Rule 2)
             showFilter: true,
             flatButtons: true,
             minColumns: ['orderNumber', 'displayCustomerName', 'orderDate'],
             columns: [
-                { name: 'orderNumber', type: 'text', alias: 'Order #' },
+                { name: 'orderNumber', type: 'button', alias: 'Order #', detailsConfig: this.salesOrderDetailsConfig },
+                // Changed (clickable-identity Phase 9b): text -> button, the row identity. detailsConfig is safe INLINE here - salesOrderDetailsConfig is an inline field initializer declared ABOVE this config, unlike productDetailsConfig which is constructor-assigned
                 { name: 'displayCustomerName', type: 'text', alias: 'Customer' },
                 { name: 'orderDate', type: 'date', alias: 'Order Date' },
                 { name: 'requiredDate', type: 'date', alias: 'Required Date' },
@@ -8055,6 +8296,7 @@ class SalesService {
         };
         this.saleItemsTableConfig = {
             tabTitle: 'Items',
+            identityColumn: false, // Added (clickable-identity Phase 9b, A-0902-13/-18): a sale LINE, not a record — the sale is the thing identified
             showFilter: false,
             elevation: 'none',
             flatButtons: true,
@@ -8163,6 +8405,7 @@ class SalesService {
         this.saleRecordPaymentButton = { name: 'record-payment', display: 'Record Payment', inDialog: true, dialog: true, icon: { name: 'payment', color: 'blue' }, detailsConfig: this.salePaymentDetailsConfig, visible: x => x.timing === 1 && x.paymentStatus !== 1 };
         this.salePaymentsTableConfig = {
             tabTitle: 'Payment History',
+            identityColumn: false, // Added (clickable-identity Phase 9b, A-0902-13/-18): a payment against a sale, not a record with an identity of its own
             showFilter: false,
             minColumns: ['paymentDate', 'amount', 'methodName'],
             columns: [
@@ -8255,6 +8498,7 @@ class PurchasingService {
         };
         this.supplierPurchaseOrderItemsTableConfig = {
             tabTitle: 'Items',
+            identityColumn: false, // Added (clickable-identity Phase 9b, A-0902-13/-18): a purchase-order LINE, not a record — the PO is the thing identified
             showFilter: false,
             elevation: 'none',
             flatButtons: true,
@@ -8339,11 +8583,13 @@ class PurchasingService {
         };
         this.supplierPurchaseOrderViewButton = { name: 'view', dialog: true, detailsConfig: this.supplierPurchaseOrderDetailsConfig };
         this.supplierPurchaseOrdersTableConfig = {
+            identityColumn: 'poNumber', // Added (clickable-identity Phase 9b): the PO number identifies the row; supplierName names the supplier it is FOR (Rule 2)
             showFilter: true,
             flatButtons: true,
             minColumns: ['poNumber', 'supplierName', 'orderDate'],
             columns: [
-                { name: 'poNumber', type: 'text', alias: 'PO #' },
+                { name: 'poNumber', type: 'button', alias: 'PO #', detailsConfig: this.supplierPurchaseOrderDetailsConfig },
+                // Changed (clickable-identity Phase 9b): text -> button, the row identity. detailsConfig is safe INLINE here - supplierPurchaseOrderDetailsConfig is an inline field initializer declared ABOVE this config, unlike productDetailsConfig which is constructor-assigned
                 { name: 'supplierName', type: 'text', alias: 'Supplier' },
                 { name: 'orderDate', type: 'date', alias: 'Order Date' },
                 { name: 'expectedDeliveryDate', type: 'date', alias: 'Expected Delivery' },
@@ -8385,6 +8631,7 @@ class PurchasingService {
         // Changed: Renamed from inventoryReceiptItemsTableConfig to purchaseItemsTableConfig
         this.purchaseItemsTableConfig = {
             tabTitle: 'Items',
+            identityColumn: false, // Added (clickable-identity Phase 9b, A-0902-13/-18): a purchase LINE, not a record — the purchase is the thing identified
             showFilter: false,
             elevation: 'none',
             flatButtons: true,
@@ -8554,6 +8801,7 @@ class PurchasingService {
         // Added: Receipt items table — shows what was physically received
         this.receiptItemsTableConfig = {
             tabTitle: 'Items',
+            identityColumn: false, // Added (clickable-identity Phase 9b, A-0902-13/-18): a receipt LINE, not a record — the receipt is the thing identified
             showFilter: false,
             elevation: 'none',
             flatButtons: true,
@@ -8608,12 +8856,14 @@ class PurchasingService {
         // Changed (WS-1 sweep 2): now OFFLINE. The earlier skip here blamed the read registry — one url per entity, so only the first purchase opened in a session could match. That gap is closed (read PREFIXes, ng-space 1e04b17): `loadCriteria: 'purchase'` registers the stem `receipts/purchase/`, so every parent matches and each keeps its own cache entry. Receipting is a receiving-bay act away from a desk and Receipt IS ISync, so it qualifies on merit now the mechanism exists.
         // Still NOT paginated, and that is separate from offline: one purchase carries a handful of receipts, so paging would cost a round trip and buy nothing.
         this.receiptsTableConfig = {
+            identityColumn: 'receiptNumber', // Added (clickable-identity Phase 9b): the receipt number identifies the row
             tabTitle: 'Receipts',
             showFilter: false,
             elevation: 'none',
             flatButtons: true,
             columns: [
-                { name: 'receiptNumber', type: 'text', alias: 'Receipt #' },
+                { name: 'receiptNumber', type: 'button', alias: 'Receipt #', detailsConfig: this.receiptDetailsConfig },
+                // Changed (clickable-identity Phase 9b): text -> button, the row identity. detailsConfig is safe INLINE here - receiptDetailsConfig is an inline field initializer declared ABOVE this config, unlike productDetailsConfig which is constructor-assigned
                 { name: 'receivedDate', type: 'date', alias: 'Received' },
                 { name: 'statusName', type: 'chip', alias: 'Status', colors: [{ name: '#E0E0E0', condition: x => x.statusName === 'Draft' }, { name: '#C8E6C9', condition: x => x.statusName === 'Completed' }] },
                 { name: 'detailsDisplay', type: 'text', alias: 'Details' } // Changed: Renamed from productsDisplay/Products
@@ -8657,6 +8907,7 @@ class PurchasingService {
         // Changed (WS-1 sweep 2): still NOT offline and still NOT paginated, but the read-registry gap is no longer the reason — that is closed. It is skipped now because this table has NOTHING TO QUEUE: its only button is a void, which is a server-side ledger reversal, and payments are recorded from the parent purchase row (supplierRecordPaymentButton), not from here. Paging is omitted separately: a purchase carries only a few payments.
         this.supplierPaymentsTableConfig = {
             tabTitle: 'Payments',
+            identityColumn: false, // Added (clickable-identity Phase 9b, A-0902-13/-18): a payment against a purchase, not a record with an identity of its own
             hidden: (x) => x.timing !== 1, // Changed: Hide Payments tab for Immediate purchases (only show for Deferred/Credit)
             showFilter: false,
             elevation: 'none',
@@ -8685,11 +8936,13 @@ class PurchasingService {
             ],
         };
         this.apAgingBaseTableConfig = {
+            identityColumn: 'purchaseNumber', // Added (clickable-identity Phase 9b): the purchase number identifies the row. RETYPED text->button (A-0902-24 revision): the detailsConfig was already declared here but type text has NO click handler, so it could never fire
             showFilter: true,
             flatButtons: true,
             minColumns: ['purchaseNumber', 'supplierName', 'outstandingAmount'], // Changed: receiptNumber → purchaseNumber
             columns: [
-                { name: 'purchaseNumber', type: 'text', alias: 'Purchase #', detailsConfig: this.purchaseDetailsConfig }, // Changed: receiptNumber → purchaseNumber, inventoryReceiptDetailsConfig → purchaseDetailsConfig
+                { name: 'purchaseNumber', type: 'button', alias: 'Purchase #', detailsConfig: this.purchaseDetailsConfig }, // Changed: receiptNumber → purchaseNumber, inventoryReceiptDetailsConfig → purchaseDetailsConfig
+                // Changed (clickable-identity Phase 9b): text -> button, the row identity. detailsConfig is safe INLINE here - purchaseDetailsConfig is an inline field initializer declared ABOVE this config, unlike productDetailsConfig which is constructor-assigned
                 { name: 'supplierName', type: 'text', alias: 'Supplier' },
                 { name: 'purchaseDate', type: 'date', alias: 'Purchase Date' }, // Changed: receiptDate → purchaseDate
                 { name: 'dueDate', type: 'date', alias: 'Due Date' },
@@ -11156,6 +11409,11 @@ class DataServiceLib {
         this.capTasks.name = "cap16";
         this.capTasks.display = "Tasks";
         this.capTasks.moduleKey = "tasks"; // Added (Setup v3)
+        // Changed (board-file-locks-and-queue-order P0-4, 2026-09-04): restored to "home/general/tasks", the original
+        // value (verified against c2c8f5ec^:211). BPI-3 had repointed this at the Work board because the Now page it
+        // used to open had been deleted; the Work module has now left tin-spa altogether and become Pulse's own
+        // "Board" (cap130, home/board in pulse-spa), so the Tasks nav item goes back to opening the Tasks page.
+        // Per fsd A17 this library restore replaces pulse-spa's local override, which is deleted in the same change.
         this.capTasks.link = "home/general/tasks";
         this.capTasks.icon = "check_box";
         this.capHR.name = "cap17";
@@ -11722,13 +11980,13 @@ class DataServiceLib {
             { key: 'outOfStock', lane: 'stores', listField: 'outOfStock', tableConfig: inventory.productsTableConfig,
                 columns: ['name', { column: 'sku', alias: 'SKU' }, 'categoryName'],
                 extraColumns: [{ name: 'minimumLevel', alias: 'Minimum' }], // book-only — the page's own column is minimumInventoryLevel and would read blank here
-                buttons: [{ button: 'view', display: 'Open the product', icon: { name: 'launch' }, tip: 'Opens this product without leaving the Day Book' }], // Changed (sweep-1, owner directive 2026-08-20): was inventory_2 + blue. A row VIEW is `launch` estate-wide (shift-spa, grip-spa, piglet's dayBookViewPig) and inventory_2 is ALSO this lane's own section glyph, so the action and the card it sat on wore the same icon for two different meanings. The blue is dropped with it — an action icon is not recoloured away from its siblings. test-spa was swept on 08-20; this is the library's own copy of the same demo config, missed then
+                buttons: [], // Changed (clickable-identity Phase 9): the 'Open the product' launch button is REMOVED — productsTableConfig.name is now the row's identity button and opens the same productDetailsConfig in place, so this was a second affordance to the same dialog on a three-column card. The 2026-08-20 directive it carried settled WHICH icon a row view wears, not that a row view must sit beside an identity
                 overrides: { ...this.libraryDayBookChrome, minColumns: ['name', 'categoryName', 'minimumLevel'], sectionConfig: { title: 'Out of Stock', icon: 'remove_shopping_cart', chips: [{ text: 'nothing left to sell', color: '#c62828' }] } }
             },
             { key: 'lowStock', lane: 'stores', listField: 'lowStock', tableConfig: inventory.productsTableConfig,
                 columns: ['name', { column: 'sku', alias: 'SKU' }, 'categoryName'],
                 extraColumns: [{ name: 'available', alias: 'In Stock' }, { name: 'minimumLevel', alias: 'Minimum' }, { name: 'shortfall', alias: 'Short By' }],
-                buttons: [{ button: 'view', display: 'Open the product', icon: { name: 'launch' }, tip: 'Opens this product without leaving the Day Book' }], // Changed (sweep-1, owner directive 2026-08-20): was inventory_2 + blue. A row VIEW is `launch` estate-wide (shift-spa, grip-spa, piglet's dayBookViewPig) and inventory_2 is ALSO this lane's own section glyph, so the action and the card it sat on wore the same icon for two different meanings. The blue is dropped with it — an action icon is not recoloured away from its siblings. test-spa was swept on 08-20; this is the library's own copy of the same demo config, missed then
+                buttons: [], // Changed (clickable-identity Phase 9): the 'Open the product' launch button is REMOVED — productsTableConfig.name is now the row's identity button and opens the same productDetailsConfig in place, so this was a second affordance to the same dialog on a three-column card. The 2026-08-20 directive it carried settled WHICH icon a row view wears, not that a row view must sit beside an identity
                 overrides: { ...this.libraryDayBookChrome, minColumns: ['name', 'available', 'shortfall'], sectionConfig: { title: 'Low Stock', icon: 'inventory_2', chips: [{ text: 'below the minimum you chose to hold', color: '#ef6c00' }] } }
             }
         ];
@@ -12221,6 +12479,14 @@ class SuffixComponent {
         // stops the click, this stops any other caller, and a write affordance that is wrong to offer is also
         // wrong to honour. Copy is untouched — it reads.
         this.readonly = false;
+        // Added (text-field-clear-icon, owner 2026-09-02): the clear X was gated on `isHovered` alone, so on a phone —
+        // where no pointer ever hovers — it could not be reached at all, and on desktop it appeared only once the mouse
+        // was already over the field. The owner's reference is the FILTER box (filter.component.html:7), whose X is
+        // gated on exactly one thing: *ngIf="_filterText" — it is there whenever there is text to clear, hover or not.
+        // `alwaysShow` lets the TYPEABLE TEXT family (text / text-single / text-area / email) adopt that same rule while
+        // number / money / date / datetime / select-multi / text-multi keep the hover behaviour they ship with today.
+        // An opt-in rather than a flipped default, because the untracked external consumers render those types too.
+        this.alwaysShow = false;
         this.infoClick = new EventEmitter();
         this.copyClick = new EventEmitter();
         this.clearClick = new EventEmitter();
@@ -12228,6 +12494,20 @@ class SuffixComponent {
     }
     ngOnInit() {
     }
+    // Added: the second half of the filter box's rule — "if it's typeable and has text, the icon should appear".
+    // A clear control on an already-empty field is an affordance that does nothing, so it is not offered at all.
+    // Deliberately allocation-free (no String(), no trim()): this is template-bound and the house bans allocating
+    // getters in templates — it returns a primitive and touches nothing.
+    get hasValue() {
+        const v = this.value;
+        if (v === null || v === undefined || v === '') {
+            return false;
+        }
+        if (Array.isArray(v)) {
+            return v.length > 0;
+        }
+        return true;
+    }
     onInfoClick(event) {
         event.stopPropagation();
         if (this.infoMessage) {
@@ -12259,11 +12539,11 @@ class SuffixComponent {
         this.clearClick.emit();
     }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: SuffixComponent, deps: [{ token: MessageService }], target: i0.ɵɵFactoryTarget.Component }); }
-    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "20.3.14", type: SuffixComponent, isStandalone: false, selector: "spa-suffix", inputs: { label: "label", infoMessage: "infoMessage", copyContent: "copyContent", isHovered: "isHovered", clearContent: "clearContent", readonly: "readonly", value: "value" }, outputs: { infoClick: "infoClick", copyClick: "copyClick", clearClick: "clearClick", valueChange: "valueChange" }, ngImport: i0, template: "<label *ngIf=\"label\">&nbsp; {{label}}</label>\n<button mat-icon-button *ngIf=\"copyContent && isHovered\" (click)=\"onCopyClick($event)\" matTooltip=\"Copy Content\" matTooltipPosition=\"above\" style=\"opacity: 1;\">\n  <mat-icon class=\"tinyIcon\">content_copy</mat-icon>\n</button>\n<button mat-icon-button *ngIf=\"clearContent && isHovered && !readonly\" (click)=\"onClearClick($event)\" matTooltip=\"Clear Content\" matTooltipPosition=\"above\" style=\"opacity: 1;\"><!-- Changed: `&& !readonly` \u2014 the X is the one affordance here that WRITES, and it rendered and fired on a locked field, so a view-only dialog could still be emptied. Copy above is deliberately NOT gated: reading a locked value is exactly what a view dialog is for. -->\n  <mat-icon class=\"tinyIcon\">close</mat-icon>\n</button>\n<button mat-icon-button *ngIf=\"infoMessage\" (click)=\"onInfoClick($event)\" [matTooltip]=\"infoMessage\" matTooltipPosition=\"above\" style=\"opacity: 1;margin-right: 2px;\">\n  <mat-icon class=\"tinyIcon\" style=\"color: steelblue;\">info</mat-icon>\n</button>\n", styles: [".smallIcon{font-size:14px}\n"], dependencies: [{ kind: "directive", type: i1$3.NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }, { kind: "component", type: i3.MatIconButton, selector: "button[mat-icon-button], a[mat-icon-button], button[matIconButton], a[matIconButton]", exportAs: ["matButton", "matAnchor"] }, { kind: "component", type: i4.MatIcon, selector: "mat-icon", inputs: ["color", "inline", "svgIcon", "fontSet", "fontIcon"], exportAs: ["matIcon"] }, { kind: "directive", type: i5$1.MatTooltip, selector: "[matTooltip]", inputs: ["matTooltipPosition", "matTooltipPositionAtOrigin", "matTooltipDisabled", "matTooltipShowDelay", "matTooltipHideDelay", "matTooltipTouchGestures", "matTooltip", "matTooltipClass"], exportAs: ["matTooltip"] }] }); }
+    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "20.3.14", type: SuffixComponent, isStandalone: false, selector: "spa-suffix", inputs: { label: "label", infoMessage: "infoMessage", copyContent: "copyContent", isHovered: "isHovered", clearContent: "clearContent", readonly: "readonly", alwaysShow: "alwaysShow", value: "value" }, outputs: { infoClick: "infoClick", copyClick: "copyClick", clearClick: "clearClick", valueChange: "valueChange" }, ngImport: i0, template: "<label *ngIf=\"label\">&nbsp; {{label}}</label>\n<button mat-icon-button *ngIf=\"copyContent && isHovered\" (click)=\"onCopyClick($event)\" matTooltip=\"Copy Content\" matTooltipPosition=\"above\" style=\"opacity: 1;\">\n  <mat-icon class=\"tinyIcon\">content_copy</mat-icon>\n</button>\n<button mat-icon-button class=\"spa-clear-btn\" *ngIf=\"clearContent && !readonly && hasValue && (isHovered || alwaysShow)\" (click)=\"onClearClick($event)\" matTooltip=\"Clear\" matTooltipPosition=\"above\" style=\"opacity: 1;\"><!-- Changed: `&& !readonly` \u2014 the X is the one affordance here that WRITES, and it rendered and fired on a locked field, so a view-only dialog could still be emptied. Copy above is deliberately NOT gated: reading a locked value is exactly what a view dialog is for. --><!-- Changed (text-field-clear-icon, owner 2026-09-02): `isHovered` became `isHovered || alwaysShow`, and `hasValue` was added. This is the FILTER box's rule (filter.component.html:7, *ngIf=\"_filterText\") brought to the typeable text family: show it when there is something to clear. Hover alone made it unreachable on a phone. Tooltip is now \"Clear\" to match the filter's word exactly \u2014 one action, one name. The .spa-clear-btn class carries the coarse-pointer touch target in tin-styles.css; the glyph, the 14px suffix sizing and the palette are unchanged. -->\n  <mat-icon class=\"tinyIcon\">close</mat-icon>\n</button>\n<button mat-icon-button *ngIf=\"infoMessage\" (click)=\"onInfoClick($event)\" [matTooltip]=\"infoMessage\" matTooltipPosition=\"above\" style=\"opacity: 1;margin-right: 2px;\">\n  <mat-icon class=\"tinyIcon\" style=\"color: steelblue;\">info</mat-icon>\n</button>\n", styles: [".smallIcon{font-size:14px}\n"], dependencies: [{ kind: "directive", type: i1$3.NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }, { kind: "component", type: i3.MatIconButton, selector: "button[mat-icon-button], a[mat-icon-button], button[matIconButton], a[matIconButton]", exportAs: ["matButton", "matAnchor"] }, { kind: "component", type: i4.MatIcon, selector: "mat-icon", inputs: ["color", "inline", "svgIcon", "fontSet", "fontIcon"], exportAs: ["matIcon"] }, { kind: "directive", type: i5$1.MatTooltip, selector: "[matTooltip]", inputs: ["matTooltipPosition", "matTooltipPositionAtOrigin", "matTooltipDisabled", "matTooltipShowDelay", "matTooltipHideDelay", "matTooltipTouchGestures", "matTooltip", "matTooltipClass"], exportAs: ["matTooltip"] }] }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: SuffixComponent, decorators: [{
             type: Component,
-            args: [{ selector: 'spa-suffix', standalone: false, template: "<label *ngIf=\"label\">&nbsp; {{label}}</label>\n<button mat-icon-button *ngIf=\"copyContent && isHovered\" (click)=\"onCopyClick($event)\" matTooltip=\"Copy Content\" matTooltipPosition=\"above\" style=\"opacity: 1;\">\n  <mat-icon class=\"tinyIcon\">content_copy</mat-icon>\n</button>\n<button mat-icon-button *ngIf=\"clearContent && isHovered && !readonly\" (click)=\"onClearClick($event)\" matTooltip=\"Clear Content\" matTooltipPosition=\"above\" style=\"opacity: 1;\"><!-- Changed: `&& !readonly` \u2014 the X is the one affordance here that WRITES, and it rendered and fired on a locked field, so a view-only dialog could still be emptied. Copy above is deliberately NOT gated: reading a locked value is exactly what a view dialog is for. -->\n  <mat-icon class=\"tinyIcon\">close</mat-icon>\n</button>\n<button mat-icon-button *ngIf=\"infoMessage\" (click)=\"onInfoClick($event)\" [matTooltip]=\"infoMessage\" matTooltipPosition=\"above\" style=\"opacity: 1;margin-right: 2px;\">\n  <mat-icon class=\"tinyIcon\" style=\"color: steelblue;\">info</mat-icon>\n</button>\n", styles: [".smallIcon{font-size:14px}\n"] }]
+            args: [{ selector: 'spa-suffix', standalone: false, template: "<label *ngIf=\"label\">&nbsp; {{label}}</label>\n<button mat-icon-button *ngIf=\"copyContent && isHovered\" (click)=\"onCopyClick($event)\" matTooltip=\"Copy Content\" matTooltipPosition=\"above\" style=\"opacity: 1;\">\n  <mat-icon class=\"tinyIcon\">content_copy</mat-icon>\n</button>\n<button mat-icon-button class=\"spa-clear-btn\" *ngIf=\"clearContent && !readonly && hasValue && (isHovered || alwaysShow)\" (click)=\"onClearClick($event)\" matTooltip=\"Clear\" matTooltipPosition=\"above\" style=\"opacity: 1;\"><!-- Changed: `&& !readonly` \u2014 the X is the one affordance here that WRITES, and it rendered and fired on a locked field, so a view-only dialog could still be emptied. Copy above is deliberately NOT gated: reading a locked value is exactly what a view dialog is for. --><!-- Changed (text-field-clear-icon, owner 2026-09-02): `isHovered` became `isHovered || alwaysShow`, and `hasValue` was added. This is the FILTER box's rule (filter.component.html:7, *ngIf=\"_filterText\") brought to the typeable text family: show it when there is something to clear. Hover alone made it unreachable on a phone. Tooltip is now \"Clear\" to match the filter's word exactly \u2014 one action, one name. The .spa-clear-btn class carries the coarse-pointer touch target in tin-styles.css; the glyph, the 14px suffix sizing and the palette are unchanged. -->\n  <mat-icon class=\"tinyIcon\">close</mat-icon>\n</button>\n<button mat-icon-button *ngIf=\"infoMessage\" (click)=\"onInfoClick($event)\" [matTooltip]=\"infoMessage\" matTooltipPosition=\"above\" style=\"opacity: 1;margin-right: 2px;\">\n  <mat-icon class=\"tinyIcon\" style=\"color: steelblue;\">info</mat-icon>\n</button>\n", styles: [".smallIcon{font-size:14px}\n"] }]
         }], ctorParameters: () => [{ type: MessageService }], propDecorators: { label: [{
                 type: Input
             }], infoMessage: [{
@@ -12276,6 +12556,8 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImpo
                 type: Input
             }], readonly: [{
                 type: Input
+            }], alwaysShow: [{
+                type: Input
             }], value: [{
                 type: Input
             }], infoClick: [{
@@ -12490,7 +12772,13 @@ class TextComponent {
         this.enterPress = new EventEmitter();
         this.width = "100%";
         this.copyContent = false;
-        this.clearContent = false;
+        // Changed (text-field-clear-icon, owner 2026-09-02): was `false`. This is a box you type into, and the owner's
+        // rule is that a typeable box with text in it always offers a way to empty it — the same rule the filter box
+        // has always had. Opting in per field declaration was the reason he never saw it: across the whole library
+        // exactly FIVE Field declarations set clearContent, and none of them is a text field.
+        // form.component.html passes `field.clearContent ?? true` so an undefined declaration lands here as true and a
+        // field that explicitly says `clearContent: false` is still honoured.
+        this.clearContent = true;
         this.required = true;
         this.min = 0;
         this.max = 9000000000000000;
@@ -12567,6 +12855,15 @@ class TextComponent {
         this.control.markAsDirty();
         this.control.markAsTouched();
         this.valueChange.emit(this.value);
+        // Added: return focus to the input. Clearing is the first half of "remove and then type again what I need" —
+        // without this the caret is left on the X button and the next keystroke goes nowhere. The emitted value is
+        // untouched: this control's cleared value is "" and stays "" (A-prime, chunk 9 — text and text-area agree).
+        this.focusInput();
+    }
+    // Added: guarded so it is a no-op before the view exists (a programmatic clear() during init) and on the
+    // server. Nothing downstream depends on it, so a missing element is silently fine.
+    focusInput() {
+        this.inputEl?.nativeElement?.focus();
     }
     enterPressed() {
         this.enterPress.emit();
@@ -12599,11 +12896,11 @@ class TextComponent {
         return "";
     }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: TextComponent, deps: [], target: i0.ɵɵFactoryTarget.Component }); }
-    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "20.3.14", type: TextComponent, isStandalone: false, selector: "spa-text", inputs: { appearance: "appearance", readonly: "readonly", hint: "hint", display: "display", placeholder: "placeholder", value: "value", format: "format", type: "type", width: "width", copyContent: "copyContent", clearContent: "clearContent", required: "required", min: "min", max: "max", regex: "regex", suffix: "suffix", infoMessage: "infoMessage" }, outputs: { valueChange: "valueChange", leave: "leave", enterPress: "enterPress" }, usesOnChanges: true, ngImport: i0, template: "<!-- Simple text input - Password, textarea, and autocomplete moved to separate components -->\n<mat-form-field [class.spa-readonly]=\"readonly\" [hideRequiredMarker]=\"!required\" [hintLabel]=\"hint\" [appearance]=\"appearance ?? 'fill'\" [ngStyle]=\"{'width':width ?? '100%'}\" style=\"margin-right: 5px;\" subscriptSizing=\"dynamic\" (mouseenter)=\"onMouseEnter()\" (mouseleave)=\"onMouseLeave()\">\n  <mat-label *ngIf=\"format=='text'\">{{display}}</mat-label>\n  <mat-label *ngIf=\"format=='date'\">{{display | date:'dd/MM/yyyy'}}</mat-label>\n  <input matInput autocomplete=\"off\" (blur)=\"leaved()\" (keyup.enter)=\"enterPressed()\" [type]=\"type\" [placeholder]=\"computedPlaceholder\" [formControl]=\"control\" [required]=\"required\" [readonly]=\"readonly\"/>\n  <mat-error *ngIf=\"control.invalid && (control.dirty || control.touched)\">{{validate(control)}}</mat-error>\n  <div matSuffix class=\"suffix-icons\">\n    <spa-suffix [label]=\"suffix\" [infoMessage]=\"infoMessage\" [copyContent]=\"copyContent\" [clearContent]=\"clearContent\" [readonly]=\"readonly\" (clearClick)=\"clear()\" [isHovered]=\"isHovered\" [(value)]=\"value\"></spa-suffix>\n  </div>\n</mat-form-field>\n", styles: [""], dependencies: [{ kind: "directive", type: i1$3.NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }, { kind: "directive", type: i1$3.NgStyle, selector: "[ngStyle]", inputs: ["ngStyle"] }, { kind: "directive", type: i2$1.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i2$1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i2$1.RequiredValidator, selector: ":not([type=checkbox])[required][formControlName],:not([type=checkbox])[required][formControl],:not([type=checkbox])[required][ngModel]", inputs: ["required"] }, { kind: "directive", type: i2$1.FormControlDirective, selector: "[formControl]", inputs: ["formControl", "disabled", "ngModel"], outputs: ["ngModelChange"], exportAs: ["ngForm"] }, { kind: "component", type: i5.MatFormField, selector: "mat-form-field", inputs: ["hideRequiredMarker", "color", "floatLabel", "appearance", "subscriptSizing", "hintLabel"], exportAs: ["matFormField"] }, { kind: "directive", type: i5.MatLabel, selector: "mat-label" }, { kind: "directive", type: i5.MatError, selector: "mat-error, [matError]", inputs: ["id"] }, { kind: "directive", type: i5.MatSuffix, selector: "[matSuffix], [matIconSuffix], [matTextSuffix]", inputs: ["matTextSuffix"] }, { kind: "directive", type: i6.MatInput, selector: "input[matInput], textarea[matInput], select[matNativeControl],      input[matNativeControl], textarea[matNativeControl]", inputs: ["disabled", "id", "placeholder", "name", "required", "type", "errorStateMatcher", "aria-describedby", "value", "readonly", "disabledInteractive"], exportAs: ["matInput"] }, { kind: "component", type: SuffixComponent, selector: "spa-suffix", inputs: ["label", "infoMessage", "copyContent", "isHovered", "clearContent", "readonly", "value"], outputs: ["infoClick", "copyClick", "clearClick", "valueChange"] }, { kind: "pipe", type: i1$3.DatePipe, name: "date" }] }); }
+    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "20.3.14", type: TextComponent, isStandalone: false, selector: "spa-text", inputs: { appearance: "appearance", readonly: "readonly", hint: "hint", display: "display", placeholder: "placeholder", value: "value", format: "format", type: "type", width: "width", copyContent: "copyContent", clearContent: "clearContent", required: "required", min: "min", max: "max", regex: "regex", suffix: "suffix", infoMessage: "infoMessage" }, outputs: { valueChange: "valueChange", leave: "leave", enterPress: "enterPress" }, viewQueries: [{ propertyName: "inputEl", first: true, predicate: ["inputEl"], descendants: true }], usesOnChanges: true, ngImport: i0, template: "<!-- Simple text input - Password, textarea, and autocomplete moved to separate components -->\n<mat-form-field [class.spa-readonly]=\"readonly\" [hideRequiredMarker]=\"!required\" [hintLabel]=\"hint\" [appearance]=\"appearance ?? 'fill'\" [ngStyle]=\"{'width':width ?? '100%'}\" style=\"margin-right: 5px;\" subscriptSizing=\"dynamic\" (mouseenter)=\"onMouseEnter()\" (mouseleave)=\"onMouseLeave()\">\n  <mat-label *ngIf=\"format=='text'\">{{display}}</mat-label>\n  <mat-label *ngIf=\"format=='date'\">{{display | date:'dd/MM/yyyy'}}</mat-label>\n  <input #inputEl matInput autocomplete=\"off\" (blur)=\"leaved()\" (keyup.enter)=\"enterPressed()\" [type]=\"type\" [placeholder]=\"computedPlaceholder\" [formControl]=\"control\" [required]=\"required\" [readonly]=\"readonly\"/>\n  <mat-error *ngIf=\"control.invalid && (control.dirty || control.touched)\">{{validate(control)}}</mat-error>\n  <div matSuffix class=\"suffix-icons\">\n    <spa-suffix [label]=\"suffix\" [infoMessage]=\"infoMessage\" [copyContent]=\"copyContent\" [clearContent]=\"clearContent\" [readonly]=\"readonly\" (clearClick)=\"clear()\" [isHovered]=\"isHovered\" [alwaysShow]=\"true\" [(value)]=\"value\"></spa-suffix><!-- Changed (text-field-clear-icon): [alwaysShow]=\"true\" \u2014 a typeable box shows its clear X whenever it holds text, hover or not, exactly like the filter box. spa-suffix still gates on !readonly and hasValue. -->\n  </div>\n</mat-form-field>\n", styles: [""], dependencies: [{ kind: "directive", type: i1$3.NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }, { kind: "directive", type: i1$3.NgStyle, selector: "[ngStyle]", inputs: ["ngStyle"] }, { kind: "directive", type: i2$1.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i2$1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i2$1.RequiredValidator, selector: ":not([type=checkbox])[required][formControlName],:not([type=checkbox])[required][formControl],:not([type=checkbox])[required][ngModel]", inputs: ["required"] }, { kind: "directive", type: i2$1.FormControlDirective, selector: "[formControl]", inputs: ["formControl", "disabled", "ngModel"], outputs: ["ngModelChange"], exportAs: ["ngForm"] }, { kind: "component", type: i5.MatFormField, selector: "mat-form-field", inputs: ["hideRequiredMarker", "color", "floatLabel", "appearance", "subscriptSizing", "hintLabel"], exportAs: ["matFormField"] }, { kind: "directive", type: i5.MatLabel, selector: "mat-label" }, { kind: "directive", type: i5.MatError, selector: "mat-error, [matError]", inputs: ["id"] }, { kind: "directive", type: i5.MatSuffix, selector: "[matSuffix], [matIconSuffix], [matTextSuffix]", inputs: ["matTextSuffix"] }, { kind: "directive", type: i6.MatInput, selector: "input[matInput], textarea[matInput], select[matNativeControl],      input[matNativeControl], textarea[matNativeControl]", inputs: ["disabled", "id", "placeholder", "name", "required", "type", "errorStateMatcher", "aria-describedby", "value", "readonly", "disabledInteractive"], exportAs: ["matInput"] }, { kind: "component", type: SuffixComponent, selector: "spa-suffix", inputs: ["label", "infoMessage", "copyContent", "isHovered", "clearContent", "readonly", "alwaysShow", "value"], outputs: ["infoClick", "copyClick", "clearClick", "valueChange"] }, { kind: "pipe", type: i1$3.DatePipe, name: "date" }] }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImport: i0, type: TextComponent, decorators: [{
             type: Component,
-            args: [{ selector: 'spa-text', standalone: false, template: "<!-- Simple text input - Password, textarea, and autocomplete moved to separate components -->\n<mat-form-field [class.spa-readonly]=\"readonly\" [hideRequiredMarker]=\"!required\" [hintLabel]=\"hint\" [appearance]=\"appearance ?? 'fill'\" [ngStyle]=\"{'width':width ?? '100%'}\" style=\"margin-right: 5px;\" subscriptSizing=\"dynamic\" (mouseenter)=\"onMouseEnter()\" (mouseleave)=\"onMouseLeave()\">\n  <mat-label *ngIf=\"format=='text'\">{{display}}</mat-label>\n  <mat-label *ngIf=\"format=='date'\">{{display | date:'dd/MM/yyyy'}}</mat-label>\n  <input matInput autocomplete=\"off\" (blur)=\"leaved()\" (keyup.enter)=\"enterPressed()\" [type]=\"type\" [placeholder]=\"computedPlaceholder\" [formControl]=\"control\" [required]=\"required\" [readonly]=\"readonly\"/>\n  <mat-error *ngIf=\"control.invalid && (control.dirty || control.touched)\">{{validate(control)}}</mat-error>\n  <div matSuffix class=\"suffix-icons\">\n    <spa-suffix [label]=\"suffix\" [infoMessage]=\"infoMessage\" [copyContent]=\"copyContent\" [clearContent]=\"clearContent\" [readonly]=\"readonly\" (clearClick)=\"clear()\" [isHovered]=\"isHovered\" [(value)]=\"value\"></spa-suffix>\n  </div>\n</mat-form-field>\n" }]
+            args: [{ selector: 'spa-text', standalone: false, template: "<!-- Simple text input - Password, textarea, and autocomplete moved to separate components -->\n<mat-form-field [class.spa-readonly]=\"readonly\" [hideRequiredMarker]=\"!required\" [hintLabel]=\"hint\" [appearance]=\"appearance ?? 'fill'\" [ngStyle]=\"{'width':width ?? '100%'}\" style=\"margin-right: 5px;\" subscriptSizing=\"dynamic\" (mouseenter)=\"onMouseEnter()\" (mouseleave)=\"onMouseLeave()\">\n  <mat-label *ngIf=\"format=='text'\">{{display}}</mat-label>\n  <mat-label *ngIf=\"format=='date'\">{{display | date:'dd/MM/yyyy'}}</mat-label>\n  <input #inputEl matInput autocomplete=\"off\" (blur)=\"leaved()\" (keyup.enter)=\"enterPressed()\" [type]=\"type\" [placeholder]=\"computedPlaceholder\" [formControl]=\"control\" [required]=\"required\" [readonly]=\"readonly\"/>\n  <mat-error *ngIf=\"control.invalid && (control.dirty || control.touched)\">{{validate(control)}}</mat-error>\n  <div matSuffix class=\"suffix-icons\">\n    <spa-suffix [label]=\"suffix\" [infoMessage]=\"infoMessage\" [copyContent]=\"copyContent\" [clearContent]=\"clearContent\" [readonly]=\"readonly\" (clearClick)=\"clear()\" [isHovered]=\"isHovered\" [alwaysShow]=\"true\" [(value)]=\"value\"></spa-suffix><!-- Changed (text-field-clear-icon): [alwaysShow]=\"true\" \u2014 a typeable box shows its clear X whenever it holds text, hover or not, exactly like the filter box. spa-suffix still gates on !readonly and hasValue. -->\n  </div>\n</mat-form-field>\n" }]
         }], ctorParameters: () => [], propDecorators: { appearance: [{
                 type: Input
             }], readonly: [{
@@ -12644,6 +12941,9 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImpo
                 type: Input
             }], infoMessage: [{
                 type: Input
+            }], inputEl: [{
+                type: ViewChild,
+                args: ['inputEl']
             }] } });
 
 // Added (token-slot, arbiter ruling A-0901-17): the login tier's minimal bearer-token attacher.
@@ -12667,6 +12967,18 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImpo
 // the login response and the shell route's injector coming up. Measured on shift-spa: 6 untokenised
 // requests and 5 x 401 on EVERY login. The app recovered and looked perfect, which is what made it
 // dangerous enough to need a ruling.
+// Changed (cold-reload 401, option D): the attacher BODY moved VERBATIM to `tin-spa/http`
+// (http/src/lib/token-attacher.ts) as `createTinTokenAttacher(getToken)`, parameterised on its only
+// dependency. Both deliberate deviations and all of their reasoning travelled with it — read that file
+// before changing the attach rules. This initializer now supplies the LOGIN tier's token source, and
+// nothing more.
+//
+// 🔴 THIS FILE IS STILL LOAD-BEARING AND MUST NOT BE REMOVED AS "UNUSED" — the note below predates
+// option D and still stands. AuthService now installs the same attacher from its own constructor, which
+// makes this registration redundant on every path where AuthService is constructed first; but the slot is
+// write-once, so a second install is a silent no-op, and the login tier keeps its own explicit,
+// route-scoped guarantee that the attacher is in place during route RECOGNITION. ONE body, TWO token
+// sources: that is the law of the pair (A-0901-17) surviving the move, not being retired by it.
 // Added: add this to the LOGIN route's providers array (alongside the rest of LOGIN_PROVIDERS). It runs
 // during route RECOGNITION — before canMatch, before any component — so it is in place well ahead of the
 // first authenticated request the login flow can produce.
@@ -12676,30 +12988,7 @@ const TIN_LOGIN_TIER_HTTP_PROVIDERS = makeEnvironmentProviders([
         multi: true,
         useValue: () => {
             const auth = inject(AuthService);
-            setTinFallbackTokenAttacher((req) => {
-                const token = auth.tokenSource.value;
-                const url = req.url || '';
-                // DELIBERATE DEVIATION 1 from LoaderInterceptor.addToken — this is CONDITIONAL on a non-empty
-                // token, where addToken is not. addToken clones unconditionally and therefore sends a bare
-                // "Bearer " when tokenSource is still empty. That is not hypothetical: it is the measured
-                // accounts-prefetch-401 defect written up at length in accounting.service.ts:2308-2326, where a
-                // prefetch fired off `loggedinObserv` beat the token into tokenSource and answered 401 every
-                // time. This attacher lives ENTIRELY inside that same pre-token window, so it would hit the bug
-                // constantly rather than occasionally. Returning the request unchanged is also what preserves
-                // the fail-open guarantee for the LOGIN POST itself, which must go out anonymously.
-                //
-                // DELIBERATE DEVIATION 2 — the refresh/revoke exclusion is INLINE here rather than at the call
-                // site. In LoaderInterceptor the same test sits in intercept() around the addToken() call
-                // (loader-interceptor.service.ts, the `url.includes('User/refresh') || url.includes('User/revoke')`
-                // line). There is no equivalent call site here — TinRootInterceptor's fallback branch is
-                // deliberately dumb — so the rule has to travel with the attacher. Those endpoints are
-                // AllowAnonymous and authenticate from the request BODY; a stale bearer on them is at best noise
-                // and at worst a rejected refresh.
-                if (!token || url.includes('User/refresh') || url.includes('User/revoke')) {
-                    return req;
-                }
-                return req.clone({ setHeaders: { Authorization: `Bearer ${token}` } });
-            });
+            setTinFallbackTokenAttacher(createTinTokenAttacher(() => auth.tokenSource.value));
         }
     }
 ]);
@@ -13248,6 +13537,31 @@ class MenuSourceService {
             return false;
         return !!this.role[cap.name] && !!cap.showMenu && this.isFeatureAllowed(cap);
     }
+    // Added (A-0902-64): does this group still have anything under it the user may open? The side nav renders
+    // a GROUP on the parent's own capability and its ENTRIES on each entry's capability, and those are not the
+    // same capability — the Inventory group keys on cap34 while its dashboard section keys on cap35, and
+    // test/pulse's `HR Officer` holds the dashboard cap without the entity cap. So a group could render with
+    // every row inside it denied: an empty expander saying the area exists while the dashboard says it does not.
+    //
+    // The rule (Arbiter A-0902-64): hide a group only when EVERY entry under it is denied. One permitted entry
+    // keeps the group AND its dead siblings — those land on the no-access page, which exists for exactly that.
+    //
+    // No second mechanism: the entry test is isVisible(), the exact conjunction the nav template applies per
+    // row (myRole[sub.name] && sub.showMenu && isFeatureAllowed(sub)), so showMenu, the tenant module and the
+    // subscription feature all count as denial here identically to how they count there.
+    //
+    // Returns TRUE — "keep rendering" — for anything that is not a group with enumerated entries: a null cap, a
+    // standalone destination, or a group carrying no entries at all. Those keep today's behaviour exactly.
+    // Deliberately NOT cached: subItemsOf's WeakMap caches static config, but the role map is live and a silent
+    // refresh or a re-login inside the same shell must repaint the menu.
+    hasVisibleEntry(capItem) {
+        if (!capItem || !capItem.capSubItems || capItem.ignoreSubsDisplay)
+            return true;
+        const entries = this.subItemsOf(capItem);
+        if (!entries.length)
+            return true;
+        return entries.some(sub => this.isVisible(sub));
+    }
     // The whole visible menu, in the SAME ORDER the side nav renders it (appConfig.capItems, unreversed —
     // 'side-modern' does not reverse; only the legacy top nav does). Computed on demand and returned fresh,
     // so callers must store the result rather than bind this method in a template.
@@ -13624,5 +13938,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.14", ngImpo
  * Generated bundle index. Do not edit.
  */
 
-export { Account, AccountingService, Action, AlertConfig, AlertMessage, ApiErrorService, ApiResponse, AppConfig, AssetStatus, AuthService, BottomTab, CacheConfig, CapItem, ChangeUserPassword, ChartConfig, ConfigService, Constants, Core, CreditNoteStatus, DataServiceLib, DateBounds, DetailsDialogConfig, DetailsDialogProcessor, DetailsSource, FilterChipConfig, FiscalPeriodStatus, FormConfig, GRID_MENU_ROUTE, GRID_MENU_TAB, GeneralService, HttpService, InventoryService, InvoiceItemType, InvoiceStatus, LastRouteService, ListDialogConfig, LoansService, LogLevel, LogService, MenuSourceService, MessageService, MovementType, NotesConfig, NotificationsService, OfflineService, PageConfig, PaginationConfig, PayrollService, PreferencesService, PrivacyDialogComponent, ProductionService, Profile, PurchaseStatus, PurchasingService, QuoteStatus, REDACTED, ReceiptDialogComponent, ReceiptStatus, RedactingSignalRLogger, Register, Role, RoleAccess, SalesService, SearchConfig, SecurityConfig, SetupService, SignalRService, SignupData, SpaCoreModule, SpaMatModule, Step, StepConfig, StorageService, SubscriptionService, SuffixComponent, TIN_INLINE_ERRORS, TIN_LOGIN_TIER_HTTP_PROVIDERS, TIN_SILENT_REQUEST, TIN_SPA_RUNTIME_CONFIG, TableConfig, TermsDialogComponent, TextComponent, TextMaskComponent, TileConfig, TransactionTiming, UnitOfMeasure, User, derivePlaceholder, describeError, describeShape, dialogOptions, getTinSpaAppSettings, isInlineErrorRequest, isSilentRequest, loadTinSpaAppSettings, loginConfig, messageDialog, phraseSatisfied, provideTinSpaRuntime, redactSecrets, silentContext, tinRequestContext, tinSpaLocationStrategyFactory, tinSpaMsalInstanceFactory, tinSpaRuntimeConfigFactory };
+export { Account, AccountingService, Action, AlertConfig, AlertMessage, ApiErrorService, ApiResponse, AppConfig, AssetStatus, AuthService, BottomTab, CacheConfig, CapItem, ChangeUserPassword, ChartConfig, ConfigService, Constants, Core, CreditNoteStatus, DashboardConfig, DataServiceLib, DateBounds, DetailsDialogConfig, DetailsDialogProcessor, DetailsSource, FilterChipConfig, FiscalPeriodStatus, FormConfig, GRID_MENU_ROUTE, GRID_MENU_TAB, GeneralService, HttpService, InventoryService, InvoiceItemType, InvoiceStatus, LastRouteService, ListDialogConfig, LoansService, LogLevel, LogService, MenuSourceService, MessageService, MovementType, NotesConfig, NotificationsService, OfflineService, PageConfig, PaginationConfig, PayrollService, PreferencesService, PrivacyDialogComponent, ProductionService, Profile, PurchaseStatus, PurchasingService, QuoteStatus, REDACTED, ReceiptDialogComponent, ReceiptStatus, RedactingSignalRLogger, Register, Role, RoleAccess, SalesService, SearchConfig, SecurityConfig, SetupService, SignalRService, SignupData, SpaCoreModule, SpaMatModule, Step, StepConfig, StorageService, SubscriptionService, SuffixComponent, TIN_INLINE_ERRORS, TIN_LOGIN_TIER_HTTP_PROVIDERS, TIN_SILENT_REQUEST, TIN_SPA_RUNTIME_CONFIG, TableConfig, TermsDialogComponent, TextComponent, TextMaskComponent, TileConfig, TransactionTiming, UnitOfMeasure, User, derivePlaceholder, describeError, describeShape, dialogOptions, getTinSpaAppSettings, isInlineErrorRequest, isSilentRequest, loadTinSpaAppSettings, loginConfig, messageDialog, phraseSatisfied, provideTinSpaRuntime, redactSecrets, silentContext, tinRequestContext, tinSpaLocationStrategyFactory, tinSpaRuntimeConfigFactory };
 //# sourceMappingURL=tin-spa-core.mjs.map